Tech

Glasswing overwhelms maintainers with underwhelming findings (VulnCheck)

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 12/11/2026, 16:50:24 UTC.

Briefings

VulnCheck's analysis of Anthropic's Project Glasswing reveals a significant gap between reported vulnerabilities and public disclosure. Since the project launched in April 2025, 37,966 findings were reported, yet only 7,349 (19.4%) are public, with just 217 marked fixed. The project's triage metrics are inconsistent, showing a 94.2% true positive rate despite a 4.4% duplicate rate, suggesting a feedback loop where withdrawn or duplicate findings inflate the positive rate. This delay has shifted vulnerability triage responsibilities to open source maintainers, creating a bottleneck for the AI security initiative.

Key points

• Only 19.4% of 37,966 reported vulnerabilities by Anthropic's Project Glasswing are publicly disclosed.
• The triage system shows a 94.2% true positive rate despite a 4.4% duplicate rate, indicating a feedback loop issue.

Context

Anthropic's Project Glasswing launched in April 2025 to identify AI security vulnerabilities. VulnCheck's review, published November 2025, highlights that while the project claims to be effective, the actual triage process is flawed, causing maintainers to absorb the burden of fixing issues that should have been identified earlier.

Limitations

Evidence is limited to VulnCheck's blog post from November 2025, which cites internal Anthropic data. The source does not provide details on the specific maintainers affected, the timeline of when fixes were actually applied, or the specific CVEs that were withdrawn. The analysis relies on internal project metrics rather than external exploitation data.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 12/11/2026, 17:21:41 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeigly5gqapvu6uwgu47frmzqhrudavvb7hm22tyelo5qw3hlugz2rm